Mozilla .XPI Spyware Issue

[Kye-U]

Quote:[Patterns]
Name = "Mozilla Force XPI Install Remover [Kye-U]"
Active = TRUE
URL = "($TYPE(htm)|$TYPE(js)|$TYPE(vb))"
Limit = 2048
Match = "((InstallTrigger)|((downloads|xpi)_manager)|(location.replace))$SET(1=ShonenScape)"
"|((%49%6E%73%74%61%6C%6C%54%72%69%67%67%65%72)|(%64%6F%77%6E%6C%6F%61%64%73%5F%6D%61%6E%61%67%65%72)|(%78%70%69%5F%6D%61%6E%61%67%65%72)|(%6C%6F%63%61%74%69%6F%6E%2E%72%65%70%6C%61%63%65)|(%2E%78%70%69)|(%31%35%41%44%34%37%38%39%2D%43%44%42%34%2D%34%37%45%31%2D%41%39%44%41%2D%39%39%32%45%45%38%45%36%42%41%44%36))$SET(1=%53%68%6F%6E%65%6E%53%63%61%70%65)"
"| onload=$AV(*.xpi*)$SET(1=)"
Replace = "\1"

It was fun writing this one. FYI, "%53%68%6F%6E%65%6E%53%63%61%70%65" is "ShonenScape" in Hex

Code:

[HTTP headers]
In = FALSE
Out = TRUE
Key = "XPI killer [Arne]"
URL = "*.xpi&(^$KEYCHK(i))"
Replace = "\k"

This is Arne's Header filter. Press "i" when you click on a safe XPI link. Otherwise, all others are killed